mailing list archives
Re: ISS issues bug disclosure guidelines
From: "SynRak" <synrak () hotmail com>
Date: Wed, 4 Dec 2002 16:58:20 -0500
I think a simple solution would be for everyone to give me their 0day code
and I will worry about who ends up with it :)
----- Original Message -----
From: "Georgi Guninski" <guninski () guninski com>
To: "Richard M. Smith" <rms () computerbytesman com>
Cc: <full-disclosure () lists netsys com>
Sent: Tuesday, December 03, 2002 5:16 AM
Subject: Re: [Full-disclosure] ISS issues bug disclosure guidelines
Personally don't care about ISS's guidelines. Of course they can do
they wish with their 0days.
*My* 0days are another topic. For them I care about applicable laws where
(and of course as this list shows, there are ways to post quite
And this guideline:
Is much more apealing to me.
So after the responsibility rfc got busted, they are fighting at corporate
I am thinking about making entities on my black list (microsoft,
mitre, cert) beg for 0days in any form.
The idea is making a license agreement/non-disclosure agreement in the
publication/code which makes them not eligible to read/use the
property at all. A lawyer said this approach is legal (of course it is
to enforce). In addition encoding like ROT13 may be used to prevent them
reverse engineering the IP (cough cough DMCA) :). There are several
of high profile code which forbids including in sf's vuln db.
Has anyone tried something like the above or has advice?
Full-Disclosure - We believe in it.